dockerized-android

Dockerized Android Dockerized Android is a container-based framework that allows to execute and Android Emulator inside Docker and control it through a browser. This project has been developed in order to provide a starting point for integrating mobile security components into Cyber Ranges but it...

CVE-2026-76816 Netty: MQTT Topic Name and Client ID Validation Bypass

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty , an asynchronous event-driven network framework, contains a validation bypass in its MqttEncoder prior to versions 4.1.137.Final and 4.2.17.Final . The encoder fails to validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null by...

CVE-2025-65670

CVE-2025-65670 Una referencia directa a objetos insegura IDOR en classroomio 0.1.13 permite a los estudiantes acceder a endpoints sensibles de administradores/profesores mediante la manipulación de IDs de cursos en las URL, lo que resulta en la divulgación no autorizada de datos sensibles del...

CVE-2023-23752

Joomla! options...

EUVD-2026-65086

Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-61419

Dell ThinOS 10, versions prior to 260510.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-61419

Dell ThinOS 10 versions prior to 2605_10.2518 are affected by an Improper Access Control vulnerability. A low-privileged attacker with local access can exploit this flaw to gain unauthorized access , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH , ve...

CVE-2026-78541

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

CVE-2026-71505

Dolibarr before 24.0.0 is affected by a Broken Object-Level Authorization (BOLA) vulnerability in the REST API third-party site account write routes . Per-object access checks are enforced only on read routes, leaving write endpoints unguarded. An authenticated attacker holding third-party creati...

CVE-2026-39975

Combodo iTop , a web-based IT service management tool, is vulnerable to remote code execution prior to version 3.2.3 . The root cause involves the ability of unauthenticated users to delete the .readonly file , which is created during setup to prevent write actions on the instance. Per the CVELIS...

Pegasus---Forbidden-Buster

Pegasus - Forbidden Buster Autor: Letda Kes dr. Sobri, S.Kom. Una herramienta de pruebas de penetración para eludir respuestas HTTP 401/403 mediante diversas técnicas de manipulación de cabeceras y fuzzing de rutas. Características Prueba diversas manipulaciones de cabeceras X-Forwarded-For,...

CVE-2025-45422---Bbox

CVE-2025-45422: Omisión de Persistencia y Control de Acceso UPnP de Proximus b-box https://vulners.com/cve/CVE-2025-45422 Este script demuestra CVE-2025-45422 que afecta a los routers Proximus b-box que ejecutan la versión de firmware 8c.725A. Aprovecha la funcionalidad UPnP del router para crear...

CVE-2026-78541

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1 . An authenticated adjacent attacker with administrative access can store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

EUVD-2026-65062

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

CVE-2026-78541 Command Injection in Parent Control of TP-Link Archer BE3600 v1

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...

CVE-2026-9254

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute th...

witcher

witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install root@kitploit: $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image root@kitploit: $ git clone [email protected]:mf-labs/witcher.gi...

EUVD-2026-65060

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-76073

Label Studio (through 1.23.0 ) has a broken access control flaw in its annotation detail endpoint. The AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() without a get_queryset override, so any annotation is retrievable by primary key. Because permissions are ...